Executive brief
The Linux kernel's Bluetooth L2CAP socket implementation contains a race condition in socket cleanup that could allow an attacker to trigger a null pointer dereference and crash the system. This affects Bluetooth connectivity on affected systems, potentially causing service disruption and denial of service.
Technical details
The vulnerability is a race condition in L2CAP socket handling between l2cap_sock_cleanup_listen() and l2cap_sock_kill() / l2cap_sock_put_chan(). The issue occurs when a socket without owning sk->sk_socket reads l2cap_pi(sk)->chan without proper synchronization, racing against concurrent cleanup that sets chan to NULL. An attacker with local access can trigger this race condition through Bluetooth socket operations to cause a null pointer dereference (null-ptr-deref), resulting in kernel panic and denial of service. The fix involves adding lock_sock() synchronization in l2cap_sock_kill() to prevent concurrent access.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-17: disclosed